jskelet 0.5.3 → 0.5.5

package/src/build/tasks/icons.mjs

@@ -1,12 +1,17 @@
 /**
- * Phosphor SVG sprite üretimi.
+ * SVG ikon sprite üretimi.
  *
- * `@phosphor-icons/core` içindeki tek tek SVG'lerden, **yalnızca kaynakta
- * kullanılan** ikonlar için `<symbol>` seti üretir. Tüm seti göndermek 1500+
- * ikon, yani birkaç megabayt; kullanım taraması sprite'ı tipik olarak 10-30
- * sembolde tutuyor.
+ * Kaynak XOR seçilir: uygulama kökünde `icons/` (veya `icons.dir`) dizini
+ * varsa yalnızca oradaki düz SVG'ler; yoksa `@phosphor-icons/core`. İkisi
+ * birleştirilmez — boş bir `icons/` dizini Phosphor'a düşmez.
+ *
+ * Yalnızca kaynakta kullanılan ikonlar `<symbol>` olur. Tüm seti göndermek
+ * 1500+ ikon, yani birkaç megabayt; kullanım taraması sprite'ı tipik olarak
+ * 10-30 sembolde tutuyor. Çıktı `public/assets/` altında hash'li
+ * `sprite.svg` olduğu için mevcut precompress kapsamına girer.
  *
  * Sembol id'si: `<kebab-name>-<weight>` (örn. `arrow-right-bold`).
+ * Yerel dosya adı: `house.svg` → `house:regular`, `house-bold.svg` → `house:bold`.
  *
  * Tarama statik metin üzerinden yapıldığı için adı çalışma anında hesaplanan
  * bir `icon()` çağrısı sprite'a girmez. Bu yüzden ad taşıyan yapılandırma
@@ -41,6 +46,8 @@ const QUOTED_NAME = /["']([A-Z][A-Za-z0-9]*)["']/g;
 
 const WEIGHTS = new Set(["thin", "light", "regular", "bold", "fill", "duotone"]);
 
+const DEFAULT_VIEWBOX = "0 0 256 256";
+
 /**
  * `ArrowRightIcon` → `arrow-right`
  * @param {string} name
@@ -54,6 +61,50 @@ function toKebab(name) {
     .toLowerCase();
 }
 
+/**
+ * Düz dizin dosya adı → `name` + `weight`.
+ * `house.svg` / `house-regular.svg` → regular; `arrow-right-bold.svg` → bold.
+ *
+ * @param {string} fileName uzantılı veya uzantısız
+ * @returns {{ name: string, weight: string } | null}
+ */
+export function parseIconFileName(fileName) {
+  const base = String(fileName).replace(/\.svg$/i, "");
+  if (!base) return null;
+
+  let name = base;
+  let weight = "regular";
+
+  const dash = base.lastIndexOf("-");
+  if (dash > 0) {
+    const maybeWeight = base.slice(dash + 1);
+    if (WEIGHTS.has(maybeWeight)) {
+      name = base.slice(0, dash);
+      weight = maybeWeight;
+    }
+  }
+
+  // kebab: harf/rakam segmentleri, başta/sonda tire yok
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) return null;
+
+  return { name, weight };
+}
+
+/**
+ * @param {import('../../config/index.js').ResolvedConfig} config
+ * @returns {string | null} mutlak dizin; yoksa veya dizin değilse null
+ */
+function resolveLocalIconsDir(config) {
+  const relative = config.icons?.dir ?? "icons";
+  const dir = path.resolve(config.root, relative);
+  try {
+    if (fs.statSync(dir).isDirectory()) return dir;
+  } catch {
+    // yok
+  }
+  return null;
+}
+
 /**
  * Paket, framework'ün değil **uygulamanın** node_modules'ünden çözülür:
  * ikon seti uygulamanın devDependency'si.
@@ -160,21 +211,80 @@ function scanUsedIcons(scanDirs) {
   return used;
 }
 
+/**
+ * @param {string} svg
+ * @returns {{ body: string, viewBox: string }}
+ */
+function parseSvgParts(svg) {
+  const open = svg.match(/<svg\b[^>]*>/i)?.[0] ?? "";
+  const viewBox =
+    open.match(/\bviewBox\s*=\s*["']([^"']+)["']/i)?.[1]?.trim() ||
+    DEFAULT_VIEWBOX;
+  const body = svg
+    .replace(/^[\s\S]*?<svg[^>]*>/i, "")
+    .replace(/<\/svg>\s*$/i, "")
+    .trim();
+  return { body, viewBox };
+}
+
+/**
+ * Düz `icons/` altındaki `*.svg` dosyalarından `name:weight` → parça haritası.
+ *
+ * @param {string} dir
+ * @returns {Map<string, { body: string, viewBox: string }>}
+ */
+function indexLocalIcons(dir) {
+  /** @type {Map<string, { body: string, viewBox: string }>} */
+  const index = new Map();
+
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isFile() || path.extname(entry.name).toLowerCase() !== ".svg") {
+      continue;
+    }
+
+    const parsed = parseIconFileName(entry.name);
+    if (!parsed) {
+      log.warn(`icon file ignored (bad name) → ${entry.name}`);
+      continue;
+    }
+
+    const key = `${parsed.name}:${parsed.weight}`;
+    const svg = fs.readFileSync(path.join(dir, entry.name), "utf8");
+    index.set(key, parseSvgParts(svg));
+  }
+
+  return index;
+}
+
 /**
  * @param {string} coreAssets
  * @param {string} name kebab
  * @param {string} weight
- * @returns {string | null}
+ * @returns {{ body: string, viewBox: string } | null}
  */
-function readIconBody(coreAssets, name, weight) {
+function readPhosphorIcon(coreAssets, name, weight) {
   const fileName = weight === "regular" ? `${name}.svg` : `${name}-${weight}.svg`;
   const filePath = path.join(coreAssets, weight, fileName);
 
   if (!fs.existsSync(filePath)) return null;
 
-  const svg = fs.readFileSync(filePath, "utf8");
-  const inner = svg.replace(/^[\s\S]*?<svg[^>]*>/, "").replace(/<\/svg>\s*$/, "");
-  return inner.trim();
+  return parseSvgParts(fs.readFileSync(filePath, "utf8"));
+}
+
+/**
+ * @param {Map<string, { body: string, viewBox: string }>} index
+ * @param {string} name
+ * @param {string} weight
+ * @returns {{ body: string, viewBox: string } | null}
+ */
+function readLocalIcon(index, name, weight) {
+  const exact = index.get(`${name}:${weight}`);
+  if (exact) return exact;
+
+  // `house.svg` regular sayılır; tarama `house:regular` ister.
+  if (weight === "regular") return index.get(`${name}:regular`) ?? null;
+
+  return null;
 }
 
 /**
@@ -182,10 +292,22 @@ function readIconBody(coreAssets, name, weight) {
  * @returns {Promise<Record<string, string>>}
  */
 export async function buildIconSprite(config) {
-  const coreAssets = resolveIconAssets(config.root);
-  if (!coreAssets) {
-    log.detail("@phosphor-icons/core not installed, skipped");
-    return {};
+  const localDir = resolveLocalIconsDir(config);
+  /** @type {Map<string, { body: string, viewBox: string }> | null} */
+  let localIndex = null;
+  /** @type {string | null} */
+  let coreAssets = null;
+
+  if (localDir) {
+    localIndex = indexLocalIcons(localDir);
+    const rel = path.relative(config.root, localDir) || ".";
+    log.detail(`icons from ${rel} (${localIndex.size} files)`);
+  } else {
+    coreAssets = resolveIconAssets(config.root);
+    if (!coreAssets) {
+      log.detail("@phosphor-icons/core not installed, skipped");
+      return {};
+    }
   }
 
   const scanDirs = (
@@ -198,15 +320,17 @@ export async function buildIconSprite(config) {
 
   for (const entry of used) {
     const [name, weight] = entry.split(":");
-    const body = readIconBody(coreAssets, name, weight);
+    const parts = localIndex
+      ? readLocalIcon(localIndex, name, weight)
+      : readPhosphorIcon(/** @type {string} */ (coreAssets), name, weight);
 
-    if (!body) {
+    if (!parts?.body) {
       missing.push(entry);
       continue;
     }
 
     symbols.push(
-      `<symbol id="${name}-${weight}" viewBox="0 0 256 256">${body}</symbol>`,
+      `<symbol id="${name}-${weight}" viewBox="${parts.viewBox}">${parts.body}</symbol>`,
     );
   }
 

package/src/client/index.js

@@ -33,3 +33,13 @@ export {
   getOverlayRoot,
 } from "./dom.js";
 export { startSafeImages } from "./safe-image.js";
+export {
+  clearSharedCookie,
+  consumeWindowNameHandoff,
+  createHandoffUrl,
+  handoffViaWindowName,
+  readCookie,
+  resolveSharedCookieDomain,
+  SHARED_COOKIE_WARN_BYTES,
+  writeSharedCookie,
+} from "./shared-cookie.js";

package/src/client/shared-cookie.js

@@ -0,0 +1,225 @@
+/**
+ * Tarayıcıda paylaşımlı cookie yazma + read-back.
+ *
+ * `document.cookie` ile Domain=.example.com yazmak bazı tarayıcılarda
+ * (Public Suffix, ITP) sessizce başarısız olur. Yazımdan sonra okunamazsa
+ * `{ handoff: true }` döner — çağıran `createHandoffUrl` veya
+ * `handoffViaWindowName` kullanır.
+ *
+ * `roots` verilmezse `document.documentElement.dataset.jskeletCookieRoots`
+ * (virgülle ayrılmış) okunur; layout'ta
+ * `data-jskelet-cookie-roots=".investvio.com,.localhost"` basılabilir.
+ */
+import {
+  SHARED_COOKIE_WARN_BYTES,
+  resolveSharedCookieDomain,
+} from "../shared/cookie-domain.js";
+
+export {
+  SHARED_COOKIE_WARN_BYTES,
+  resolveSharedCookieDomain,
+  stripHostPort,
+} from "../shared/cookie-domain.js";
+
+/**
+ * @returns {string[]}
+ */
+function rootsFromDom() {
+  if (typeof document === "undefined") return [];
+  const raw = document.documentElement?.dataset?.jskeletCookieRoots ?? "";
+  return raw
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+/**
+ * @param {string} name
+ * @returns {string | null}
+ */
+export function readCookie(name) {
+  if (typeof document === "undefined") return null;
+  const prefix = `${encodeURIComponent(name)}=`;
+  for (const part of document.cookie.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed.startsWith(prefix)) continue;
+    try {
+      return decodeURIComponent(trimmed.slice(prefix.length));
+    } catch {
+      return trimmed.slice(prefix.length);
+    }
+  }
+  return null;
+}
+
+/**
+ * @typedef {object} ClientSharedCookieResult
+ * @property {boolean} ok
+ * @property {string | null} domain
+ * @property {boolean} handoff
+ * @property {string} [reason]
+ */
+
+/**
+ * @param {string} name
+ * @param {string} value
+ * @param {{ roots?: string[], maxAge?: number, path?: string, sameSite?: string,
+ *   secure?: boolean }} [options]
+ * @returns {ClientSharedCookieResult}
+ */
+export function writeSharedCookie(name, value, options = {}) {
+  if (typeof document === "undefined") {
+    return { ok: false, domain: null, handoff: true, reason: "no-document" };
+  }
+
+  const roots = options.roots ?? rootsFromDom();
+  const domain = resolveSharedCookieDomain(location.hostname, roots);
+  if (!domain) {
+    return { ok: false, domain: null, handoff: true, reason: "no-matching-root" };
+  }
+
+  const text = String(value ?? "");
+  if (new TextEncoder().encode(text).length > SHARED_COOKIE_WARN_BYTES) {
+    return { ok: false, domain, handoff: true, reason: "value-too-large" };
+  }
+
+  const secure = options.secure ?? location.protocol === "https:";
+  const parts = [
+    `${encodeURIComponent(name)}=${encodeURIComponent(text)}`,
+    `Path=${options.path ?? "/"}`,
+    `Domain=${domain}`,
+    `SameSite=${options.sameSite ?? "Lax"}`,
+  ];
+  if (options.maxAge !== undefined) {
+    parts.push(`Max-Age=${Math.floor(Number(options.maxAge))}`);
+  }
+  if (secure) parts.push("Secure");
+
+  document.cookie = parts.join("; ");
+
+  // Read-back: tarayıcı Domain'i reddettiyse cookie görünmez.
+  if (readCookie(name) !== text) {
+    return { ok: false, domain, handoff: true, reason: "readback-failed" };
+  }
+
+  return { ok: true, domain, handoff: false };
+}
+
+/**
+ * @param {string} name
+ * @param {{ roots?: string[], path?: string, secure?: boolean, sameSite?: string }} [options]
+ * @returns {ClientSharedCookieResult}
+ */
+export function clearSharedCookie(name, options = {}) {
+  if (typeof document === "undefined") {
+    return { ok: false, domain: null, handoff: false, reason: "no-document" };
+  }
+
+  const roots = options.roots ?? rootsFromDom();
+  const domain = resolveSharedCookieDomain(location.hostname, roots);
+  if (!domain) {
+    return { ok: false, domain: null, handoff: false, reason: "no-matching-root" };
+  }
+
+  const secure = options.secure ?? location.protocol === "https:";
+  const parts = [
+    `${encodeURIComponent(name)}=`,
+    `Path=${options.path ?? "/"}`,
+    `Domain=${domain}`,
+    "Max-Age=0",
+    `SameSite=${options.sameSite ?? "Lax"}`,
+  ];
+  if (secure) parts.push("Secure");
+  document.cookie = parts.join("; ");
+
+  return { ok: true, domain, handoff: false };
+}
+
+/**
+ * Handoff bileti ister; dönen URL'ye gidilir (`?handoff=` taşır).
+ *
+ * @param {{ name: string, value: string, next: string }} body
+ * @param {{ path?: string }} [options]
+ * @returns {Promise<string | null>}
+ */
+export async function createHandoffUrl(body, options = {}) {
+  const path = options.path ?? "/_jskelet/auth/handoff";
+  const response = await fetch(path, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      accept: "application/json",
+    },
+    credentials: "same-origin",
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) return null;
+  /** @type {{ ok?: boolean, url?: string }} */
+  const data = await response.json().catch(() => ({}));
+  return typeof data.url === "string" ? data.url : null;
+}
+
+/**
+ * first-party `window.name` köprüsü — cookie Domain reddedilince yedek.
+ * Kaynak sayfada hedefe gitmeden önce çağırın; hedefte
+ * `consumeWindowNameHandoff` okur.
+ *
+ * @param {string} targetUrl
+ * @param {{ name: string, value: string, maxAge?: number }} cookie
+ * @returns {void}
+ */
+export function handoffViaWindowName(targetUrl, cookie) {
+  if (typeof window === "undefined") return;
+  window.name = JSON.stringify({
+    jskeletHandoff: 1,
+    cookie: {
+      name: cookie.name,
+      value: cookie.value,
+      maxAge: cookie.maxAge,
+    },
+  });
+  location.assign(targetUrl);
+}
+
+/**
+ * Hedef host'ta `window.name` içindeki handoff'u host-only cookie olarak yazar.
+ *
+ * @param {{ write?: typeof writeSharedCookie }} [options]
+ *   Varsayılan: Domain denemeden host-only `document.cookie`.
+ * @returns {boolean} Bir şey yazıldı mı.
+ */
+export function consumeWindowNameHandoff(options = {}) {
+  if (typeof window === "undefined") return false;
+
+  let payload;
+  try {
+    payload = JSON.parse(window.name || "");
+  } catch {
+    return false;
+  }
+
+  if (!payload || payload.jskeletHandoff !== 1 || !payload.cookie?.name) {
+    return false;
+  }
+
+  window.name = "";
+
+  const { name, value, maxAge } = payload.cookie;
+  const text = String(value ?? "");
+  const secure = location.protocol === "https:";
+  const parts = [
+    `${encodeURIComponent(name)}=${encodeURIComponent(text)}`,
+    "Path=/",
+    "SameSite=Lax",
+  ];
+  if (maxAge !== undefined) parts.push(`Max-Age=${Math.floor(Number(maxAge))}`);
+  if (secure) parts.push("Secure");
+  document.cookie = parts.join("; ");
+
+  if (typeof options.write === "function") {
+    options.write(name, text, { maxAge });
+  }
+
+  return readCookie(name) === text;
+}

package/src/config/defaults.js

@@ -453,4 +453,23 @@ export const DEFAULT_BRAND = {
   devBasePath: "/__jskelet/dev",
   prewarmUserAgent: "jskelet-prewarm",
   devTokenCookie: "dev_token",
+  /**
+   * Paylaşımlı cookie Domain kökleri (örn. `.investvio.com`, `.localhost`).
+   * `writeSharedCookie` host bunlardan birine uyuyorsa Domain olarak yazar.
+   * @type {string[]}
+   */
+  sharedCookieRoots: [],
+};
+
+/**
+ * Kimlik / alt alan handoff. Framework oturum vermez; yalnızca çapraz-subdomain
+ * cookie köprüsü opsiyoneldir.
+ */
+export const DEFAULT_AUTH = {
+  /**
+   * `true` veya `{ ttlSeconds?, path?, maxValueBytes? }`.
+   * Açıkken `POST /_jskelet/auth/handoff` ve `?handoff=` redeem middleware'i.
+   * @type {boolean | { enabled?: boolean, ttlSeconds?: number, path?: string, maxValueBytes?: number }}
+   */
+  crossSubdomainHandoff: false,
 };

package/src/config/index.js

@@ -21,6 +21,7 @@
  *                   maxEntries?: number,
  *                   data?: {...}, redis?: {...}, prewarm?: {...} }
  *   admin()     → { enabled?, basePath?, allowIps?, blockBots?, … }
+ *   auth        → { crossSubdomainHandoff?: boolean | object }
  *   logs        → { console?, kinds?, file?, s3? }
  *
  * Fonksiyon olmayan bölümler (`brand`, `security`, `static`, `navigation`…)
@@ -33,6 +34,7 @@ import { pathToFileURL } from "node:url";
 import { compilePattern, matchPattern } from "./pattern.js";
 import {
   DEFAULT_ADMIN,
+  DEFAULT_AUTH,
   DEFAULT_BRAND,
   DEFAULT_CLOUDFLARE,
   DEFAULT_DATA_CACHE,
@@ -126,6 +128,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {Record<string, unknown>} prewarm
  * @property {{ source: string, test: (pathname: string) => boolean }[]} prewarmPriority
  * @property {Record<string, unknown>} brand
+ * @property {{ crossSubdomainHandoff: boolean | Record<string, unknown> }} auth
  * @property {Record<string, Function>} hooks
  * @property {string} layout Layout `.ejs` dosyasının mutlak yolu.
  * @property {string[] | null} routes Açık route modülü listesi.
@@ -138,7 +141,7 @@ const CONFIG_FILE = "jskelet.config.mjs";
  * @property {string[]} prewarmSkip
  * @property {string[]} watch Dev sunucusunun izlediği ek dizinler.
  * @property {{ family: string, slug?: string, weights: number[] }[]} fonts
- * @property {{ scan?: string[] } | false} icons
+ * @property {{ scan?: string[], dir: string } | false} icons
  * @property {ImagesConfig | false} images
  * @property {string[]} clientEnv Client bundle'a gömülecek env anahtarları.
  */
@@ -896,6 +899,59 @@ function normalizeNavigation(raw, brand) {
  *   headerName: string }} csrf
  */
 
+/**
+ * @param {unknown} raw
+ * @returns {Record<string, unknown>}
+ */
+function normalizeBrand(raw) {
+  const source = /** @type {Record<string, unknown>} */ (raw ?? {});
+  const roots = asArray(
+    source.sharedCookieRoots ?? DEFAULT_BRAND.sharedCookieRoots,
+    "brand.sharedCookieRoots",
+  )
+    .filter((entry) => typeof entry === "string")
+    .map((entry) => {
+      const trimmed = String(entry).trim().toLowerCase();
+      if (!trimmed) return null;
+      return trimmed.startsWith(".") ? trimmed : `.${trimmed}`;
+    })
+    .filter((entry) => entry !== null);
+
+  return {
+    ...DEFAULT_BRAND,
+    ...source,
+    sharedCookieRoots: roots,
+  };
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {{ crossSubdomainHandoff: boolean | Record<string, unknown> }}
+ */
+function normalizeAuth(raw) {
+  if (raw == null || typeof raw !== "object" || Array.isArray(raw)) {
+    return { ...DEFAULT_AUTH };
+  }
+
+  const source = /** @type {Record<string, unknown>} */ (raw);
+  const handoff = source.crossSubdomainHandoff;
+
+  if (handoff === true || handoff === false || handoff == null) {
+    return {
+      crossSubdomainHandoff: handoff === true,
+    };
+  }
+
+  if (typeof handoff === "object" && !Array.isArray(handoff)) {
+    return { crossSubdomainHandoff: { ...handoff } };
+  }
+
+  console.warn(
+    "[config] auth.crossSubdomainHandoff must be boolean or object, ignoring it",
+  );
+  return { ...DEFAULT_AUTH };
+}
+
 /**
  * Güvenlik bölümü. `csrf.exclude` desenleri burada derlenir: her istekte
  * yeniden derlemek gereksiz, ve bozuk bir desen sunucuyu düşürmemeli.
@@ -931,6 +987,34 @@ function normalizeSecurity(raw) {
   };
 }
 
+/**
+ * İkon sprite ayarları. `false` → adım atlanır. `dir` varsayılanı `"icons"`:
+ * o dizin varsa yalnızca yerel SVG'ler; yoksa Phosphor.
+ *
+ * @param {unknown} raw
+ * @returns {{ scan?: string[], dir: string } | false}
+ */
+function normalizeIcons(raw) {
+  if (raw === false) return false;
+
+  const source = /** @type {Record<string, any>} */ (raw ?? {});
+  const dir =
+    typeof source.dir === "string" && source.dir.trim()
+      ? source.dir.trim()
+      : "icons";
+
+  /** @type {{ scan?: string[], dir: string }} */
+  const icons = { dir };
+
+  if (source.scan != null) {
+    icons.scan = asArray(source.scan, "icons.scan")
+      .filter((entry) => typeof entry === "string" && entry.trim())
+      .map((entry) => String(entry).trim());
+  }
+
+  return icons;
+}
+
 /**
  * Build + runtime görsel ayarları. `false` → her iki yüzey de kapalı.
  * `remote.allowHosts` boşsa remote kapalı kalır (açık proxy olmasın).
@@ -1132,7 +1216,8 @@ export async function loadConfig(options = {}) {
     prewarmPriority,
   } = normalizeCache(cache);
   const dirs = resolveDirs(root, source.paths);
-  const brand = { ...DEFAULT_BRAND, ...(source.brand ?? {}) };
+  const brand = normalizeBrand(source.brand);
+  const auth = normalizeAuth(source.auth);
 
   config = {
     root,
@@ -1157,6 +1242,7 @@ export async function loadConfig(options = {}) {
     prewarm,
     prewarmPriority,
     brand,
+    auth,
     hooks: source.hooks ?? {},
     layout: resolveLayout(dirs, source.layout),
     routes: Array.isArray(source.routes) ? source.routes : null,
@@ -1179,7 +1265,7 @@ export async function loadConfig(options = {}) {
     // Build tarafı ayarları. Sunucu bunları okumaz ama config tek dosya
     // olsun diye aynı yerden geçer.
     fonts: source.fonts ?? [],
-    icons: source.icons ?? {},
+    icons: normalizeIcons(source.icons),
     images: normalizeImages(source.images),
     clientEnv: source.clientEnv ?? [],
   };

package/src/http/cookies-entry.js

@@ -0,0 +1,20 @@
+/**
+ * `jskelet/cookies` paket girişi — imzalı cookie + paylaşımlı Domain yüzeyi.
+ */
+export {
+  clearCookie,
+  getSignedCookie,
+  parseCookies,
+  randomToken,
+  safeEqual,
+  serializeCookie,
+  setCookie,
+  setSignedCookie,
+} from "./cookies.js";
+export {
+  clearSharedCookie,
+  requestIsHttps,
+  resolveSharedCookieDomain,
+  SHARED_COOKIE_WARN_BYTES,
+  writeSharedCookie,
+} from "./shared-cookie.js";

package/src/http/cookies.js

@@ -144,6 +144,7 @@ export function parseCookies(req) {
  * @property {Date} [expires]
  * @property {boolean} [httpOnly] Varsayılan `true`.
  * @property {boolean} [secure] Varsayılan: development dışında `true`.
+ *   `writeSharedCookie` protokole bakarak ezer (`https` → Secure).
  * @property {"Strict" | "Lax" | "None"} [sameSite] Varsayılan `Lax`.
  */
 
@@ -255,3 +256,4 @@ export function getSignedCookie(req, name) {
 export function randomToken(bytes = 32) {
   return crypto.randomBytes(bytes).toString("base64url");
 }
+